Pri­va­cy Poli­cy

1. Name and address of the con­trol­ler

The con­trol­ler in the sen­se of the Gene­ral Data Pro­tec­tion Regu­la­ti­on and other natio­nal data pro­tec­tion legis­la­ti­on of the mem­ber sta­tes, as well as other data pro­tec­tion pro­vi­si­ons, is:

W. Zim­mer­mann GmbH & Co. KG, Rie­der­stra­ße 7, 88171 Wei­ler-Sim­mer­berg

Name and address of the data pro­tec­tion offi­cer:

W. Zim­mer­mann GmbH & Co. KG
Daten­schutz­be­auf­trag­ter
Rie­der­stra­ße 7
88171 Wei­ler-Sim­mer­berg
Ger­ma­ny

Pho­ne: +49 8322 18–0
E‑mail: datenschutzbeauftragter@zimsi.com

Data sub­jects may cont­act our data pro­tec­tion offi­cer direct­ly with any ques­ti­ons and sug­ges­ti­ons regar­ding data pro­tec­tion.

2. Gene­ral infor­ma­ti­on on data pro­ces­sing

2.1 Scope of pro­ces­sing per­so­nal data

We gene­ral­ly pro­cess the per­so­nal data of our users only inso­far as this is requi­red to pro­vi­de an ope­ra­ti­ve web­site and for our con­tents and ser­vices. Pro­ces­sing of the per­so­nal data of our users regu­lar­ly takes place only fol­lo­wing con­sent of the user. An excep­ti­on appli­es in tho­se cases when obtai­ning con­sent before­hand is not pos­si­ble for valid reasons, or data pro­ces­sing is per­mit­ted by law.

2.2 Legal basis for pro­ces­sing per­so­nal data

As far as we obtain con­sent from a data sub­ject for pro­ces­sing ope­ra­ti­ons of per­so­nal data, Artic­le 6(1)(a) EU Gene­ral Data Pro­tec­tion Regu­la­ti­on (GDPR) ser­ves as the legal basis.

When pro­ces­sing per­so­nal data is requi­red for the per­for­mance of a con­tract to which the data sub­ject is the con­trac­tu­al par­ty, Artic­le 6(1)(b) GDPR ser­ves as the legal basis. This also appli­es to pro­ces­sing ope­ra­ti­ons that are neces­sa­ry for con­duc­ting pre-con­trac­tu­al mea­su­res.

When pro­ces­sing of per­so­nal data is requi­red for com­pli­ance with a legal obli­ga­ti­on to which our com­pa­ny is sub­ject, Artic­le 6(1)© GDPR ser­ves as the legal basis.

In the event that vital inte­rests of the data sub­ject or ano­ther natu­ral per­son make pro­ces­sing of per­so­nal data neces­sa­ry, Artic­le 6(1)(d) GDPR shall ser­ve as the legal basis.

When pro­ces­sing is requi­red to main­tain a legi­ti­ma­te inte­rest of our com­pa­ny or a third par­ty, and when the inte­rests, fun­da­men­tal rights and free­doms of the data sub­ject do not out­weigh the for­mer inte­rest, Artic­le 6(1)(f) GDPR ser­ves as the legal basis for pro­ces­sing.

2.3 Data era­su­re and sto­rage peri­od

The per­so­nal data of the data sub­ject will be era­sed or blo­cked as soon as the pur­po­se for sto­rage lap­ses. In addi­ti­on, sto­rage can take place if pro­vi­ded for by Euro­pean or natio­nal legis­la­tors in EU ordi­nan­ces, laws or other regu­la­ti­ons to which the con­trol­ler is sub­ject. Blo­cking or era­su­re of data is also car­ri­ed out when a sto­rage peri­od sti­pu­la­ted in the stan­dards refer­red to expi­res unless the­re is a need for fur­ther data sto­rage for the con­clu­si­on of a con­tract or per­for­mance of a con­tract.

3. Pro­vi­si­on of the web­site and crea­ti­on of log­files

3.1 Descrip­ti­on and scope of data pro­ces­sing

With every access of our web­site, our sys­tem auto­ma­ti­cal­ly coll­ects data and infor­ma­ti­on from the com­pu­ter sys­tem of the acces­sing com­pu­ter.

The fol­lo­wing data is coll­ec­ted:

  • infor­ma­ti­on about the brow­ser type and ver­si­on used
  • the ope­ra­ting sys­tem of the user
  • the Inter­net ser­vice pro­vi­der of the user
  • the IP address of the user
  • the date and time of the access
  • web­sites from which the sys­tem of the user is refer­red to our web­site
  • web­sites which are acces­sed from the user’s sys­tem via our web­site

The log files con­tain IP addres­ses or other data that enable an assign­ment to a user. This could be the case, for exam­p­le, if the link to the web­site from which the user is refer­red to the web­site or the link to the web­site to which the user swit­ches con­ta­ins per­so nal data. The data are also stored in our system’s log files. Sto­rage of the­se data tog­e­ther with other per­so­nal data of the user does not take place.

3.2 Legal basis for data pro­ces­sing

The legal basis for the tem­po­ra­ry sto­rage of data and log files is Artic­le 6(1)(f) GDPR.

3.3 Pur­po­se of data pro­ces­sing

The tem­po­ra­ry sto­rage of the IP address by the sys­tem is neces­sa­ry to allow pro­vi­si­on of the web­site to the user’s com­pu­ter. This requi­res the user’s IP address to be stored for the dura­ti­on of the ses­si­on.

Sto­rage in log files takes place to ensu­re the website’s func­tion­a­li­ty and to ward off attacks. In addi­ti­on, the data are used to opti­mi­ze the web­site and to ensu­re the secu­ri­ty of our infor­ma­ti­on tech­no­lo­gy sys­tems. Data ana­ly­sis for mar­ke­ting pur­po­ses does not occur in this con­text.

Accor­ding to Artic­le 6(1)(f) GDPR, the­se pur­po­ses also repre­sent our legi­ti­ma­te inte­rest in data pro­ces­sing.

3.4 Sto­rage peri­od

The data will be dele­ted as soon as they are no lon­ger requi­red to achie­ve the pur­po­se of their coll­ec­tion. If data are coll­ec­ted for the pro­vi­si­on of the web­site, this is the case when the respec­ti­ve ses­si­on has ended.

If the data are stored in log files, this is the case after seven days at the latest. Sto­rage bey­ond that time is pos­si­ble. In this case, the users’ IP addres­ses are dele­ted or defa­mi­lia­ri­zed so that an asso­cia­ti­on with the acces­sing cli­ent is no lon­ger pos­si­ble.

3.5 Means of objec­tion and eli­mi­na­ti­on

The coll­ec­tion of data for the pro­vi­si­on of the web­site and the sto­rage of data in log files is impe­ra­ti­ve for the ope­ra­ti­on of the web­site. Con­se­quent­ly, the user can­not object.

4. Use of coo­kies

4.1 Descrip­ti­on and scope of data pro­ces­sing

Our web­site uses coo­kies. Coo­kies are text files that are stored in the Inter­net brow­ser or by the Inter­net brow­ser on the user’s com­pu­ter sys­tem. When a user acces­ses a web­site, a coo­kie may be stored on the user’s ope­ra­ting sys­tem. This coo­kie con­ta­ins a cha­rac­te­ristic string which enables the brow­ser to be cle­ar­ly iden­ti­fied when the web­site is reac­ces­sed.

We use coo­kies to make our web­site more user-fri­end­ly. Some ele­ments of our web­site requi­re the acces­sing brow­ser to be iden­ti­fied even after a page chan­ge.

For more infor­ma­ti­on on which coo­kies are stored, how long and with what con­tent, plea­se refer to the infor­ma­ti­on in the con­sent dia­log of the coo­kie set­tings. To do this, click the (i) next to the rele­vant ser­vices.

Go to coo­kie set­tings 

4.2 Legal basis for data pro­ces­sing

The legal basis for pro­ces­sing per­so­nal data using tech­ni­cal­ly neces­sa­ry coo­kies is Artic­le 6(1)(f) GDPR.

The legal basis for pro­ces­sing per­so­nal data using coo­kies for ana­ly­sis pur­po­ses is Artic­le 6(1)(a) GDPR if the user has con­sen­ted to this.

4.3 Pur­po­se of data pro­ces­sing

The pur­po­se of using tech­ni­cal­ly neces­sa­ry coo­kies is to faci­li­ta­te the use of web­sites for users. Some func­tions of our web­site can­not be pro­vi­ded wit­hout coo­kies. For the­se func­tions, the brow­ser must be reco­gni­zed again even after a chan­ge of pages.

We need coo­kies for the fol­lo­wing appli­ca­ti­ons:

  • saving the con­sent gran­ted
  • remem­be­ring search terms
  • saving the sel­ec­ted page lan­guage

The user data coll­ec­ted by tech­ni­cal­ly neces­sa­ry coo­kies will not be used to crea­te user pro­files.

The use of other coo­kies is car­ri­ed out to impro­ve the qua­li­ty of our web­site and its con­tents. We learn how the web­site is used on the basis of the ana­ly­sis coo­kies, and can thus con­stant­ly opti­mi­ze our offer.

Accor­ding to Artic­le 6(1)(f) GDPR, the­se pur­po­ses also repre­sent our legi­ti­ma­te inte­rest in pro­ces­sing per­so­nal data.

4.4 Sto­rage peri­od, means of objec­tion and eli­mi­na­ti­on

Coo­kies are stored on the user’s com­pu­ter and trans­mit­ted to our web­site from the­re. The­r­e­fo­re, you, as a user, have full con­trol over the use of coo­kies. By modi­fy­ing the set­tings in your Inter­net brow­ser, you can disable or rest­rict the trans­mis­si­on of coo­kies. Pre­vious­ly stored coo­kies can be dele­ted at any time. This can also be done auto­ma­ti­cal­ly. If you disable coo­kies for our web­site, you may no lon­ger be able to use all of the website’s fea­tures to their full ext­ent.

5. Cont­act form and e‑mail cont­act

5.1 Descrip­ti­on and scope of data pro­ces­sing

Our web­site offers a cont­act form that can be used to estab­lish cont­act elec­tro­ni­cal­ly. If a user takes this oppor­tu­ni­ty, the data ente­red in the input mask will be trans­mit­ted to us and stored. The­se data are:

  • Data ente­red

Within the frame­work of the regis­tra­ti­on pro­cess, we obtain your con­sent to data pro­ces­sing and refer to this pri­va­cy poli­cy.

Alter­na­tively, you can cont­act us via the e‑mail address pro­vi­ded. In this case, the user’s per­so­nal data trans­mit­ted in the e‑mail will be stored.

The­re will be no trans­mis­si­on of data to third par­ties in this con­text. The data will be used exclu­si­ve­ly for pro­ces­sing the con­ver­sa­ti­on.

5.2 Legal basis for data pro­ces­sing

The legal basis for data pro­ces­sing under the pre­sence of con­sent by the user is Artic­le 6(1)(a) GDPR. The legal basis for pro­ces­sing data trans­mit­ted in the con­text of sen­ding an e‑mail is Artic­le 6(1)(f) GDPR. If the cont­act aims at the con­clu­si­on of a con­tract, the addi­tio­nal legal basis for pro­ces­sing is Artic­le 6(1)(b) GDPR.

5.3 Pur­po­se of data pro­ces­sing

Pro­ces­sing of per­so­nal data from the input mask sole­ly ser­ves for pro­ces­sing your out­reach. In the event of cont­ac­ting via e‑mail, this also repres­ents the requi­red legi­ti­ma­te inte­rest in pro­ces­sing the data.

The other per­so­nal data pro­ces­sed during the trans­mis­si­on pro­cess are inten­ded to pre­vent abu­se of the cont­act form and ensu­re the safe­ty of our infor­ma­ti­on tech­no­lo­gy sys­tems.

5.4 Sto­rage peri­od

The data will be era­sed as soon as they are no lon­ger requi­red to ful­fill the pur­po­se of their coll­ec­tion, and the­re are no other sta­tu­to­ry reten­ti­on peri­ods. 

5.5 Means of objec­tion and eli­mi­na­ti­on

Users can revo­ke their con­sent to the pro­ces­sing of per­so­nal data at any time. If users cont­act us by e‑mail, they can object to the sto­rage of their per­so­nal data at any time. The con­ver­sa­ti­on can­not be con­tin­ued in such cases.

6. Use by third-par­ty tools

6.1 Scope of pro­ces­sing per­so­nal data by third par­ties

In order to pro­vi­de and con­ti­nuous­ly impro­ve our ser­vices, we rely on the ser­vices of the fol­lo­wing third-par­ty pro­vi­ders, which may also pro­cess per­so­nal data. We have sel­ec­ted the­se third-par­ty pro­vi­ders careful­ly and fol­lo­wing the pro­vi­si­ons of the GDPR.

6.1.1 Goog­le Maps

Unless other­wi­se sta­ted in this pri­va­cy poli­cy, the ope­ra­tor of all Goog­le ser­vices men­tio­ned here is Goog­le Ire­land Limi­t­ed, Goog­le Buil­ding Gor­don House, 4 Bar­row St, Dub­lin, D04 E5W5, Ire­land.

We have inte­gra­ted the “Goog­le Maps” ser­vice via API in order to be able to dis­play geo­gra­phi­cal infor­ma­ti­on. Using Goog­le Maps allows Goog­le to coll­ect, pro­cess and use data about your use of the ser­vice. By using Goog­le Maps, infor­ma­ti­on about the use of this web­site, inclu­ding your IP address and the (start) address ente­red as part of the rou­te plan­ner func­tion, may be trans­mit­ted to Goog­le in the USA. Goog­le sends the map’s con­tent direct­ly to the user’s brow­ser and, from the­re, inte­gra­tes it into the web­site. We do not have any influence on the amount of data Goog­le coll­ects in this way. We also have no influence on the fur­ther pro­ces­sing and use of the data by Goog­le and, the­r­e­fo­re, can­not accept any respon­si­bi­li­ty for this. Plea­se refer to Google’s pri­va­cy poli­cy for more infor­ma­ti­on about how Goog­le pro­ces­ses your data.

Goog­le Maps coll­ects and pro­ces­ses the fol­lo­wing data:

  • IP address
  • loca­ti­on infor­ma­ti­on
  • usa­ge data
  • date and time of the visit
  • URLs

The legal basis of pro­ces­sing is Artic­le 6(1)(a) GDPR. Con­sent is vol­un­t­a­ry and can be refu­sed or revo­ked at any time with effect for the future.

The per­so­nal data is stored for as long as it is requi­red to ful­fill the pur­po­se of pro­ces­sing. The data will be dele­ted as soon as they are no lon­ger requi­red to ful­fill the pur­po­se of their coll­ec­tion.

In addi­ti­on to Goog­le Ire­land Limi­t­ed, the data may be trans­mit­ted to the fol­lo­wing reci­pi­ents as part of pro­ces­sing:

– Goog­le LLC.

– Alpha­bet Inc.

Goog­le may trans­fer data to third count­ries, such as the USA, in the con­text of pro­ces­sing. We would like to point out that, in the opi­ni­on of the Euro­pean Court of Jus­ti­ce, the­re is curr­ent­ly no ade­qua­te level of pro­tec­tion for data trans­fers to the USA. This may be asso­cia­ted with various risks to the lega­li­ty and secu­ri­ty of data pro­ces­sing. So-cal­led SCC gene­ral­ly gua­ran­tee the secu­ri­ty of the trans­fer. This is inten­ded to ensu­re that the pro­ces­sing is sub­ject to a level of secu­ri­ty that com­pli­es with the GDPR. If the SCC are insuf­fi­ci­ent, con­sent is obtai­ned in advan­ce fol­lo­wing Artic­le 49(1)(a) GDPR.

With the SCC, Goog­le sub­mits to the Euro­pean level of data pro­tec­tion when pro­ces­sing the rele­vant data, even if this data is stored and pro­ces­sed in the USA. The SCC are based on an imple­men­ting decis­i­on of the EU Com­mis­si­on, which is available here: https://eurlex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.

The Goog­le Ads Data Pro­ces­sing Terms with refe­rence to the SCC are available here: https://business.safety.google/intl/de/adsprocessorterms/.

If you want to learn more about Goo­g­le’s data pro­ces­sing, plea­se go to: https://policies.google.com/privacy?hl=de .

6.1.2 Goog­le Ana­ly­tics

We use the ana­ly­sis track­ing tool Goog­le Ana­ly­tics (GA) by the US com­pa­ny “Goog­le Inc” on our web­site. Goog­le Ire­land Limi­t­ed (Gor­don House, Bar­row Street Dub­lin 4, Ire­land) is respon­si­ble for all Goog­le ser­vices for the Euro­pean area.

Goog­le Ana­ly­tics coll­ects data about your actions on our web­site, such as cli­cking on a link, and trans­mits this to Goog­le Ana­ly­tics. This is used to crea­te reports that allow us to bet­ter cus­to­mi­ze our web­site to the expec­ta­ti­ons of web­site visi­tors.

The­se reports include, among others:

  • tar­get group reports
  • ad reports
  • acqui­si­ti­on reports
  • beha­vi­or reports
  • con­ver­si­on reports
  • real-time reports

Goog­le Ana­ly­tics uses the coo­kie to reco­gni­ze a repeat visit.

The sto­rage peri­od is 14 months, and for “Uni­ver­sal Ana­ly­tics” 26 months. After this peri­od, the user data is dele­ted.

The legal basis of pro­ces­sing is A rtic­le 6(1)(a) GDPR. Con­sent is vol­un­t­a­ry and can be refu­sed or revo­ked at any time with effect for the future.

The per­so­nal data will be stored until the pur­po­se of pro­ces­sing has been ful­fil­led and dele­ted as soon as they are no lon­ger requi­red to ful­fill the pur­po­se.

In addi­ti­on to Goog­le Ire­land Limi­t­ed, the data may be trans­mit­ted to the fol­lo­wing reci­pi­ents as part of pro­ces­sing:

– Goog­le LLC.

– Alpha­bet Inc.

Goog­le may trans­fer data to third count­ries, such as the USA, in the con­text of pro­ces­sing. We would like to point out that, in the opi­ni­on of the Euro­pean Court of Jus­ti­ce, the­re is curr­ent­ly no ade­qua­te level of pro­tec­tion for data trans­fers to the USA. This may be asso­cia­ted with various risks to the lega­li­ty and secu­ri­ty of data pro­ces­sing. So-cal­led SCC gene­ral­ly gua­ran­tee the secu­ri­ty of the trans­fer. This is inten­ded to ensu­re that the pro­ces­sing is sub­ject to a level of secu­ri­ty that com­pli­es with the GDPR. If the SCC are insuf­fi­ci­ent, con­sent is obtai­ned in advan­ce fol­lo­wing Artic­le 49(1)(a) GDPR.

With the SCC, Goog­le sub­mits to the Euro­pean level of data pro­tec­tion when pro­ces­sing the rele­vant data, even if this data is stored and pro­ces­sed in the USA. The SCC are based on an imple­men­ting decis­i­on of the EU Com­mis­si­on, which is available here: https://eurlex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.

The Goog­le Ads Data Pro­ces­sing Terms with refe­rence to the SCC are available here: https://business.safety.google/intl/de/adsprocessorterms/.

If you want to learn more about Goo­g­le’s data pro­ces­sing, plea­se go to: https://policies.google.com/privacy?hl=de .

6.1.3 You­Tube

We have embedded You­Tube vide­os on our web­site, made available via a plug­in by Goog­le Ire­land Ltd. in Ire­land (“You­Tube”). Goog­le Ire­land Limi­t­ed (Gor­don House, Bar­row Street Dub­lin 4, Ire­land) is respon­si­ble for all Goog­le ser­vices for the Euro­pean area.

We use the “exten­ded data pro­tec­tion set­tings” for embedded You­Tube vide­os, i.e., You­Tube does not set any coo­kies.

When acces­sing vide­os, the fol­lo­wing data, among others, is trans­mit­ted to You­Tube:

·      IP address,

·      inter­ac­tions of users who have been refer­red to the com­pany’s web­site via an ad

By com­bi­ning the IP address and page acti­vi­ty, Goog­le can crea­te a per­so­na­li­zed user pro­fi­le.

The legal basis of pro­ces­sing is Artic­le 6(1)(a) GDPR. Con­sent is vol­un­t­a­ry and can be refu­sed or revo­ked at any time with effect for the future.

The per­so­nal data will be stored until the pur­po­se of pro­ces­sing has been ful­fil­led and dele­ted as soon as they are no lon­ger requi­red to ful­fill the pur­po­se.

In addi­ti­on to Goog­le Ire­land Limi­t­ed, the data may be trans­mit­ted to the fol­lo­wing reci­pi­ents as part of pro­ces­sing:

– Goog­le LLC.

– Alpha­bet Inc.

When using Goog­le, per­so­nal data is trans­fer­red to a third coun­try out­side the EU. The trans­fer takes place based on an EU ade­quacy decis­i­on (Data Pri­va­cy Frame­work, DPF). As part of the DPF, the EU Com­mis­si­on has deter­mi­ned that an ade­qua­te level of data pro­tec­tion also exists for US com­pa­nies that have under­go­ne a spe­ci­fic (self-)certification pro­cess. This is the case for Goog­le: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt000000001L5AAI&status=Active

Alter­na­tively, we gua­ran­tee that sui­ta­ble safe­guards are pro­vi­ded for the trans­fer in accordance with Artic­le 46 GDPR. We will be hap­py to pro­vi­de you with pro­of of sui­ta­ble safe­guards (stan­dard con­trac­tu­al clau­ses) at any time upon request. If the SCC are ins uffi­ci­ent, con­sent is obtai­ned in advan­ce fol­lo­wing Artic­le 49(1)(a) GDPR.

With the SCC, Goog­le sub­mits to the Euro­pean level of data pro­tec­tion when pro­ces­sing the rele­vant data, even if this data is stored and pro­ces­sed in the USA. The SCC are based on an imple­men­ting decis­i­on of the EU Com­mis­si­on, which is available here: https://eurlex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.

The Goog­le Ads Data Pro­ces­sing Terms with refe­rence to the SCC are available here: https://business.safety.google/intl/de/adsprocessorterms/.

If you want to learn more about Goo­g­le’s data pro­ces­sing, plea­se go to: https://policies.google.com/privacy?hl=de.

6.1.4 User­cen­trics

We use the Con­sent Manage­ment Plat­form (CMP) User­cen­trics on our web­site. The ser­vice pro­vi­der is the Ger­man com­pa­ny User­cen­trics GmbH, Send­lin­ger Stra­ße 7, 80331 Munich, Ger­ma­ny. If you want to learn more about the data pro­ces­sed using User­cen­trics, plea­se refer to their pri­va­cy poli­cy at https://usercentrics.com/privacy-policy/.

6.2 Legal basis for pro­ces­sing per­so­nal data

The legal basis of pro­ces­sing is Artic­le 6(1)(a) GDPR. Con­sent is vol­un­t­a­ry and can be refu­sed or revo­ked at any time with effect for the future.

6.3 Pur­po­se of data pro­ces­sing

Unless spe­ci­fied other­wi­se, pro­ces­sing of users’ per­so­nal data allows us, among other things, to ana­ly­ze the sur­fing beha­vi­or of our users. The ana­ly­sis of the data obtai­ned allows us to com­pi­le infor­ma­ti­on about the use of the indi­vi­du­al com­pon­ents of our web­site. This helps us to impro­ve our web­site and its user fri­end­li­ne­ss con­ti­nuous­ly. Accor­ding to Artic­le 6(1)(f) GDPR, the­se pur­po­ses also repre­sent our legi­ti­ma­te inte­rest in pro­ces­sing the data. By anony­mi­zing the IP address, the inte­rest of users in the pro­tec­tion of their per­so­nal data is suf­fi­ci­ent­ly accoun­ted for.

6.4 Sto­rage peri­od

Unless spe­ci­fied other­wi­se, the data will be dele­ted as soon as they are no lon­ger requi­red for our recor­ding pur­po­ses.

6.5 Means of objec­tion and eli­mi­na­ti­on

Unless spe­ci­fied sepa­ra­te­ly for the indi­vi­du­al ser­vices, coo­kies are stored on the user’s com­pu­ter and trans­mit­ted by it to us and/or the third-par­ty pro­vi­ders. The user can – also auto­ma­ti­cal­ly – disable or rest­rict the crea­ti­on or trans­mis­si­on of coo­kies in their brow­ser set­tings and dele­te coo­kies that have alre­a­dy been saved. Wit­hout coo­kies, you may no lon­ger be able to use all of the website’s fea­tures.

When opting out, ano­ther coo­kie is set that tells us not to store the user’s data If the user dele­tes this coo­kie, the opt-out coo­kie must be set again.

7. Rights of the data sub­ject

If your per­so­nal data are pro­ces­sed, you will be con­side­red a data sub­ject within the mea­ning of the GDPR and have the fol­lo­wing rights against the con­trol­ler:

7.1 Right of access

You can request a con­fir­ma­ti­on from the con­trol­ler whe­ther we pro­cess per­so­nal data con­cer­ning you.

If the­re is such pro­ces­sing, you can request the fol­lo­wing infor­ma­ti­on from the con­trol­ler:

  • the pur­po­ses for which the per­so­nal data are pro­ces­sed;
  • the cate­go­ries of per­so­nal data which are pro­ces­sed;
  • the reci­pi­ents or cate­go­ries of reci­pi­ents to whom the per­so­nal data con­cer­ning you have been dis­c­lo­sed or will be dis­c­lo­sed;
  • the plan­ned sto­rage peri­od of per­so­nal data con­cer­ning you or, if spe­ci­fic details on this are not pos­si­ble, cri­te­ria for deter­mi­ning the sto­rage peri­od;
  • the exis­tence of a right to rec­ti­fi­ca­ti­on or era­su­re of per­so­nal data con­cer­ning you, the right to rest­ric­tion of pro­ces­sing by the con­trol­ler or a right to object to this pro­ces­sing;
  • the exis­tence of a right of appeal to a super­vi­so­ry aut­ho­ri­ty;
  • all available infor­ma­ti­on about the ori­gin of the data if the per­so­nal data are not coll­ec­ted from the data sub­ject;
  • the exis­tence of auto­ma­ted decis­i­on-making, inclu­ding pro­fil­ing accor­ding to Artic­le 22(1) and (4) GDPR and – at least in the­se cases – meaningful infor­ma­ti­on about the logic invol­ved as well as the scope and desi­red effects of such pro­ces­sing for the data sub­ject.

You have the right to demand infor­ma­ti­on on whe­ther or not per­so­nal data con­cer­ning you are trans­mit­ted to a third coun­try or an inter­na­tio­nal orga­niza­ti­on. In this con­text, you may request to be infor­med about the appro­pria­te safe­guards accor­ding to Artic­le 46 GDPR in con­nec­tion with the trans­mis­si­on.

7.2 Right to rec­ti­fi­ca­ti­on

You have the right to rec­ti­fi­ca­ti­on and/or com­ple­ti­on against the con­trol­ler if the pro­ces­sed per­so­nal data con­cer­ning you are inac­cu­ra­te or incom­ple­te. The con­trol­ler shall rec­ti­fy this imme­dia­te­ly.

7.3 Right to rest­ric­tion of pro­ces­sing

On con­di­ti­on of the fol­lo­wing, you can demand the rest­ric­tion of pro­ces­sing of the per­so­nal data con­cer­ning you:

  • if you chall­enge the accu­ra­cy of the per­so­nal data con­cer­ning you for a peri­od which allows the con­trol­ler to check the accu­ra­cy of the per­so­nal data;
  • pro­ces­sing is unlawful, and you dis­miss the era­su­re of the per­so­nal data and ins­tead demand the rest­ric­tion of the use of the per­so­nal data;
  • the con­trol­ler no lon­ger needs the per­so­nal data for pro­ces­sing, but you need them for the enforce­ment, exer­cise or defen­se of legal claims, or
  • if you have objec­ted to pro­ces­sing in accordance with Artic­le 21 (1) GDPR and it has not yet been deci­ded whe­ther the controller’s legi­ti­ma­te reasons out­weigh your reasons.

If the pro­ces­sing of per­so­nal data con­cer­ning you has been rest­ric­ted, the­se data – apart from sto­rage – can only be pro­ces­sed with your con­sent or for the enforce­ment, exer­cise or defen­se of legal claims, or the pro­tec­tion of the rights of ano­ther natu­ral or legal per­son, or reasons of sub­stan­ti­al public inte­rest of the Euro­pean Uni­on or of a mem­ber sta­te.

If the rest­ric­tion of pro­ces­sing has been limi­t­ed accor­ding to the pre­re­qui­si­tes men­tio­ned abo­ve, you will be infor­med by the con­trol­ler befo­re the rest­ric­tion is resc­in­ded.

7.4 Right to era­su­re

7.4.1 Obli­ga­ti­on for era­su­re

You can request the con­trol­ler to era­se the per­so­nal data con­cer­ning you imme­dia­te­ly, and the con­trol­ler will be obli­ged to era­se the­se data imme­dia­te­ly if one of the fol­lo­wing reasons appli­es:

  • The per­so­nal data con­cer­ning you are no lon­ger neces­sa­ry for the pur­po­ses for which they were coll­ec­ted or pro­ces­sed in any other way.
  • You revo­ke your con­sent on which the pro­ces­sing was based accor­ding to Artic­le 6(1)(a) or Artic­le 9(2)(a) GDPR, and the­re is no other legal basis for pro­ces­sing.
  • You object to pro­ces­sing accor­ding to Artic­le 21(1) GDPR, and the­re are no other legi­ti­ma­te reasons for pro­ces­sing, or you object to pro­ces­sing accor­ding to Artic­le 21(2) GDPR.
  • The per­so­nal data con­cer­ning you have been pro­ces­sed unlawful­ly.
  • The era­su­re of the per­so­nal data con­cer­ning you is requi­red for com­pli­ance with a legal obli­ga­ti­on accor­ding to Euro­pean Uni­on law or the law of the mem­ber sta­tes to which the con­trol­ler is sub­ject.
  • The per­so­nal data con­cer­ning you have been coll­ec­ted in rela­ti­on to the offer of infor­ma­ti­on socie­ty ser­vices in accordance with Artic­le 8(1) GDPR.

7.4.2 Infor­ma­ti­on to third par­ties

If the con­trol­ler has dis­c­lo­sed the per­so­nal data con­cer­ning you and if they are obli­ged to era­se the­se data accor­ding to Artic­le 17(1) GDPR, they shall, taking into account the available tech­no­lo­gy and imple­men­ta­ti­on cos­ts, take the appro­pria­te mea­su­res, also of a tech­ni­cal natu­re, to inform the per­sons respon­si­ble for data pro­ces­sing that you as the data sub­ject have reques­ted the era­su­re of all links to the­se per­so­nal data or of copies or repli­ca­ti­ons of the­se per­so­nal data.

7.4.3 Excep­ti­ons

The right to era­su­re does not app­ly if pro­ces­sing is requi­red

  • for exer­cis­ing the right of free­dom of expres­si­on and infor­ma­ti­on;
  • for com­pli­ance with a legal obli­ga­ti­on requi­ring pro­ces­sing in accordance with the law of the Euro­pean Uni­on or the mem­ber sta­tes to which the con­trol­ler is sub­ject, or for the per­for­mance of a task car­ri­ed out in the public inte­rest, or in the exer­cise of public aut­ho­ri­ty ves­ted in the con­trol­ler;
  • on grounds of public inte­rest in the field of public health pur­su­ant to Artic­le 9(2)(h) and (i) and Artic­le 9(3) GDPR;
  • for the enforce­ment, exer­cise or defen­se of legal claims.

7.5 Right to be infor­med

If you have enforced the right to rec­ti­fi­ca­ti­on, era­su­re or rest­ric­tion of pro­ces­sing against the con­trol­ler, they are obli­ga­ted to noti­fy all reci­pi­ents to whom the per­so­nal data con­cer­ning you have been dis­c­lo­sed about this rec­ti­fi­ca­ti­on, era­su­re or rest­ric­tion of pro­ces­sing of the data unless this pro­ves impos­si­ble or invol­ves dis­pro­por­tio­na­te effort.

You have the right against the con­trol­ler to be infor­med about the­se reci­pi­ents.

7.6 Right to data por­ta­bi­li­ty

You have the right to obtain the per­so­nal data con­cer­ning you which you have pro­vi­ded to the con­trol­ler in a struc­tu­red, com­mon and machi­ne-rea­da­ble for­mat. You also have the right to trans­mit tho­se data to ano­ther con­trol­ler wit­hout hin­drance from the con­trol­ler to whom the per­so­nal data have been pro­vi­ded if

  • pro­ces­sing is based on con­sent accor­ding to Artic­le 6(1)(a) GDPR or Artic­le 9(2)(a) GDPR or on a con­tract accor­ding to Artic­le 6(1)(b) GDPR and
  • pro­ces­sing takes place using auto­ma­ted pro­ce­du­res.

In exer­cis­ing this right, you also have the right to obtain that the per­so­nal data con­cer­ning you are direct­ly trans­fer­red to ano­ther con­trol­ler by a con­trol­ler inso­far as this is tech­ni­cal­ly fea­si­ble. This must not affect any civil liber­ties and rights of other per­sons.

The right to data por­ta­bi­li­ty does not app­ly to the pro­ces­sing of per­so­nal data requi­red for the per­for­mance of a task in the public inte­rest or in the exer­cise of public aut­ho­ri­ty ves­ted in the con­trol­ler. 

7.7 Right to object

You have the right to object to the pro­ces­sing of per­so­nal data con­cer­ning you coll­ec­ted accor­ding to Artic­le 6(1)(e) or (f) GDPR for reasons ari­sing from your spe­ci­fic situa­ti­on at any time; this also appli­es to pro­fil­ing based on the­se pro­vi­si­ons.

The con­trol­ler will no lon­ger pro­cess your per­so­nal data unless they can demons­tra­te com­pel­ling legi­ti­ma­te grounds for pro­ces­sing which over­ri­de your inte­rests, rights, and free­doms or for the enforce­ment, exer­cise, or defen­se of legal claims.

If the per­so­nal data con­cer­ning you will be pro­ces­sed for pur­po­ses of direct adver­ti­sing, you have the right to object to the pro­ces­sing of per­so­nal data con­cer­ning you for the pur­po­ses of such adver­ti­sing at any time; this also appli­es to pro­fil­ing in so far as this is con­nec­ted with such direct adver­ti­sing.

If you object to pro­ces­sing for direct adver­ti­sing pur­po­ses, the per­so­nal data con­cer­ning you will no lon­ger be pro­ces­sed for the­se pur­po­ses.

In the con­text of the offer of infor­ma­ti­on socie­ty ser­vices – not­wi­th­stan­ding Direc­ti­ve 2002/58/EC – you have the opti­on to exer­cise your right to objec t using auto­ma­ted pro­ces­ses in which tech­ni­cal spe­ci­fi­ca­ti­ons are used.

7.8 Right to revo­ke your con­sent to the pri­va­cy poli­cy

You can revo­ke your con­sent to the pri­va­cy poli­cy at any time. The revo­ca­ti­on of con­sent does not affect the lega­li­ty of pro­ces­sing car­ri­ed out until the revo­ca­ti­on on the basis of the con­sent gran­ted.

7.9 Auto­ma­ted indi­vi­du­al decis­i­on-making, inclu­ding pro­fil­ing

You have the right not to be sub­jec­ted to a decis­i­on sole­ly based on auto­ma­ted pro­ces­sing – inclu­ding pro­fil­ing – which takes legal effect against you or signi­fi­cant­ly impacts you in a simi­lar way. This does not app­ly if the decis­i­on

  • is requi­red for the con­clu­si­on or per­for­mance of a con­tract bet­ween you and the con­trol­ler,
  • due to sta­tu­to­ry pro­vi­si­ons of the Euro­pean Uni­on or the mem­ber sta­tes to which the con­trol­ler is sub­ject, is admis­si­ble, and the­se sta­tu­to­ry pro­vi­si­ons con­tain appro­pria­te mea­su­res in order to safe­guard your rights and free­doms as well as your legi­ti­ma­te inte­rests or
  • takes place with your expli­cit con­sent.

Howe­ver, the­se decis­i­ons must not be based on spe­cial cate­go­ries of per­so­nal data accor­ding to Artic­le 9(1) GDPR unless Artic­le 9(2)(a) or (g) GDPR appli­es and ade­qua­te mea­su­res for the pro­tec­tion of the rights and free­doms as well as your legi­ti­ma­te inte­rests have been taken.

With regard to the first and the lat­ter cases, the con­trol­ler takes appro­pria­te mea­su­res in order to safe­guard the rights and free­doms as well as your legi­ti­ma­te inte­rests, which includes at least the right to obtain the inter­ven­ti­on of a per­son on the part of the con­trol­ler, the right to pre­sent of one’s posi­ti­on and the right to chall­enge the decis­i­on.

7.10 Right to appeal to a super­vi­so­ry aut­ho­ri­ty

Wit­hout pre­ju­di­ce to any other admi­nis­tra­ti­ve or judi­cial reme­dy, you have the right to appeal to a super­vi­so­ry aut­ho­ri­ty, espe­ci­al­ly in the mem­ber sta­te of your place of resi­dence, your place of work or the loca­ti­on of the alle­ged inf­rin­ge­ment, if you think that the pro­ces­sing of per­so­nal data con­cer­ning you inf­rin­ges the GDPR.

The super­vi­so­ry aut­ho­ri­ty to which you have appea­led informs the clai­mant about the complaint’s sta­tus and results, inclu­ding the pos­si­bi­li­ty of a judi­cial reme­dy accor­ding to Artic­le 78 GDPR.

Template Part Not Found